本頁列出影響 mongodb c_driver 的已公開 CVE 漏洞（透過 NVD CPE 關聯）。每列包含嚴重程度評分、摘要與發布日期，便於識別與分析安全議題。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2026-6691 | The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI. | [email protected] | 8.6 | 0.13% | 2026-05-06 | 2026-06-18 |
| CVE-2026-6231 | The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version | [email protected] | 5.3 | 0.18% | 2026-04-13 | 2026-06-17 |
| CVE-2026-4359 | A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver. | [email protected] | 2.0 | 0.19% | 2026-03-17 | 2026-06-17 |
| CVE-2025-12119 | A mongoc_bulk_operation_t may read invalid memory if large options are passed. | [email protected] | 6.9 | 0.18% | 2025-11-18 | 2026-06-17 |
| CVE-2024-7553 | Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to | [email protected] | 7.3 | 0.26% | 2024-08-07 | 2026-06-17 |
| CVE-2023-0437 | When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0. | [email protected] | 5.3 | 1.10% | 2024-01-12 | 2026-06-17 |
| CVE-2021-32050 | Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This | [email protected] | 4.2 | 0.49% | 2023-08-29 | 2026-06-16 |
| CVE-2020-12135 | bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input. | [email protected] | 5.5 | 1.17% | 2020-04-23 | 2026-06-16 |